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DETAILED ACTION 

1. Claims 1-38 are pending. Applicant has amended claims 1-2, 4-9 and 1 1-25 and added 
claims 26-38. 

Continued Examination Under 37 CFR LI 14 

2. A request for continued examination under 37 CFR 1.114, including the fee set forth in 
37 CFR 1. 17(e), was filed in this application after final rejection. Since this application is 
eligible for continued examination under 37 CFR 1.114, and the fee set forth in 37 CFR 1 .17(e) 
has been timely paid, the finality of the previous Office action has been withdrawn pursuant to 
37 CFR 1.1 14. Applicant's submission filed on 8/1/2005 has been entered. 

Claim Rejections - 35 USC § 102 

3. The following is a quotation of the appropriate paragraphs of 35 U.S. C. 102 that form the 
basis for the rejections under this section made in this Office action: 

A person shall be entitled to a patent unless - 

(e) the invention was described in (1) an application for patent, published under section 122(b), by another filed 
in the United States before the invention by the applicant for patent or (2) a patent granted on an application for 
patent by another filed in the United States before the invention by the applicant for patent, except that an 
international application filed under the treaty defined in section 351(a) shall have the effects for purposes of this 
subsection of an application filed in the United States only if the international application designated the United 
States and was published under Article 21(2) of such treaty in the English language. 

4. Claims 10 and 13 rejected under 35 ILS.C. 102(e) as being anticipated by Niemi et al 
(U.S. 6,470,388). 



5. 



As to claim 10, Nock teaches a system comprising: 
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- a foundational layer (logging service layer 316, 318, network communication facility 
332, 334, and centralized logger 236) upon which applications (network management 
applications 208a, 208b) are built and executed (fig. 3); and 

- an event logging mechanism (logging service layer 3 16, 3 18, and centralized logger 
236) executing independent of said applications [It is noted that getting debug objects or states 
does not involve actions of an application program, col. 14, lines 46-63; col. 15, lines 43-48], 
said mechanism for generating an event log (record or data entry 514) for any of said 
applications without referencing any event logs of said applications [it is noted that the 
production of record 514 does not reference any event logs of the applications]. See col. 11, line 
53 -col. 12, line 61. 

6. As to claim 13, Niemi teaches the foundational layer includes a programmable 
framework (libraries to implement logging service layer, col. 6, lines 55-67). 

Claim Rejections - 35 USC §103 

7. The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set forth in 
section 102 of this title, if the differences between the subject matter sought to be patented and the prior art are 
such that the subject matter as a whole would have been obvious at the time the invention was made to a person 
having ordinary skill in the art to which said subject matter pertains. Patentability shall not be negatived by the 
manner in which the invention was made. 

8. Claims 12, 23, 24 and 26-29 are rejected under 35 U.S.C. 103(a) as being 
unpatentable over Niemi et al (U.S. 6,470,388). 
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9. As to claim 12, Niemi teaches the foundational layer includes network communication 
functionality (332, 334) which is typically provided by an operating system. Therefore, it would 
have been obvious to include an operating system into the foundational layer of Niemi. 

As to claim 23, Niemi teaches a system comprising: 

- a foundational layer (logging service layer 3 16, 3 18, network communication facility 
332, 334, and centralized logger 236) upon which applications (network management 
applications 208a, 208b) are built and executed (fig. 3; col 1 1, line 53 - col. 12, line 61), 

- a first application (network management applications 208a, 208b) for executing on said 
foundational layer (fig. 3), 

- a second application (network management applications 208a, 208b) for execution on 
said foundational layer (fig. 3), 

- a third event-logging application for execution on said foundational layer (application 
with enabled debug object) / an event logging mechanism (logging service layer 3 16, 3 18, and 
centralized logger 236), for functioning interoperably with (enable/disable state of a debug 
object) but separately (separate address spaces, fig. 3) from said first and second applications, 
and for generating an event log (log file 506 containing records 514) for either of said first and 
second applications (application with its corresponding debug object enabled). See col. 8, lines 
1 1-43; col. 1 1, line 1 - col 12, line 29. 

10. Niemi teaches only when an application's debug object is enabled, the application's event 
data is logged, generating an event log. Col. 8, lines 1 1-43; col. 11, line 1 - col. 12, line 29. 
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Therefore, it would have been obvious that in Niemi at least one of said first and second 
applications does not generate an event log, i.e., when its debug object is not enabled. Regarding 
'event-logging application', note section 3 of this office action. 

11. As to claim 24, Niemi teaches storing, for each event to be logged, a temporal attribute 
(time stamp 516) of the event in the event object (record 514) associated with the event. See fig. 
5 and denoting text. 

12. As to claim 26, Niemi teaches a first area of memory allocated to the first application, a 
second area of memory allocated to the second application, and a third area of memory allocated 
to the event logging mechanism, wherein the third area of memory is separate from the areas of 
memory allocated to the first and second applications (separate address spaces; see Fig. 3 and 
associated text). 

13. As to claim 27, Niemi teaches an enable/disable state for each event identified by the 
application wherein the disable state precludes any system from creating an event log (col. 1 1, 
lines 45-65). 

14. As to claim 28, Niemi teaches generating an event log is performed for each event having 
event logging enabled (col. 1 1, lines 45-65). 



15. 



As to claim 29, see rejection of claim 13 above. 
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16. Claims 1-3, 11, 14, 19, 21, 30-32 and 34-38 are rejected under 35 U.S.C. 103(a) as 
being unpatentable over Niemi et al (U.S. 6,470,388) in view of Ladwig (U.S. 2002/0138663 
Al). 

17. As to claim 11, Niemi teaches the event logging mechanism logs time (time stamp 516) 
and other event information (fields 518, 520, 522, 524) into an event object (record or data entry 
514) for every event to be logged. Col. 12, lines 11-15. 

18. Niemi does not teach logging start time and end time. Ladwig teaches for every event, 
logging start time (Datetime; page 4, section 0054) and duration time (Duration; page 4, section 
0058) for each event. Although Ladwig does not teach the end time, it would have been obvious 
one of ordinary skill in the art could store the end time instead of duration time for the event. 

19. One of ordinary skill in the art would have been motivated to combine the teachings of 
Niemi and Ladwig because this would allowed customization of event logging and analysis for 
each application of Niemi. 

20. As to claim 14, Niemi teaches the event logging mechanism can be turned on (set state of 
the debug object to disabled) and then off (set state of the debug object to disabled) from beyond 
the execution space of said applications within said foundation layer (from centralized logging 
facility). See col. 11, lines 24-44; col. 14, lines 1-45). 
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21 . As to claim 21, Niemi teaches an apparatus comprising: 

- means for creating (logging service layer 3 16, 3 18, network communication facility 
332, 334, and centralized logger 236), for every event (event) to be logged that has not been 
logged [it is noted that Niemi does not disclose a prior logging step] within an application 
(application 208a, 208b), an event object (record 514), said event object occupying a memory 
space (database 504 / log file 506) (col. 12, lines 8-15); 

- means for logging (logging service layer 316, 318, and centralized logger 236) within 
said event object (record 514) the time (time stamp 516) and other event information (fields 518, 
520, 522, 524). Col. 12, lines 11-15. 

22. Niemi does not teach logging start time and end time. Ladwig teaches for every event, 
logging start time (Datetime; page 4, section 0054) and duration time (Duration; page 4, section 
0058) for each event. Although Ladwig does not teach the end time, it would have been obvious 
one of ordinary skill in the art could store the end time instead of duration time for the event. 

23. One of ordinary skill in the art would have been motivated to combine the teachings of 
Niemi and Ladwig because this would allowed customization of event logging and analysis for 
each application of Niemi. 

24. Regarding the event object executing independent of said application, in Niemi, the event 
logging mechanism (logging service layer 316, 318, and centralized logger 236) executes 
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independent of the applications [It is noted that getting debug objects or states does not involve 
actions of an application program, col. 14, lines 46-63; col. 15, lines 43-48]. 

25. As to claim 1, it is a method claim of claim 21, and thus note claim 21 for discussion. 

26. As to claims 2, 3, Niemi teaches checking, for each event identified by the application, 
whether event logging has been turned on (issue GetStateO on debug object), creating and 
logging are performed for each event having event logging turned on (perform logging if state of 
the debug object is enabled), wherein a plurality of event objects are created (record 5 14) and 
logged (log file 516) for a plurality of events (402, 404, 406, 408). See col. 8, lines 9-42; col. 1 1, 
line 66 - col. 12, line 15. 

27. As to claim 19, it is a program product claim of claim 1, thus note claim 1 for discussion. 

28. As to claim 30, it is the same as the method claim of claim 1 and is rejected under the 
same ground of rejection. Further see Fig. 3 and associated text. 

29. As to claim 31, see rejection of claim 27 above. 



30. 



As to claim 32, see rejection of claim 2 above. 
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31. As to claim 34, Niemi teaches the memory space occupied by the event log is within 
memory space that has been allocated solely to the event logging mechanism (central logging 
facility; see Fig. 2 and associated text). 

32. As to claim 35, Niemi teaches the events that are logged by the event logging mechanism 
have not been previously logged by any other application (see rejection of claim 21 above 
regarding this limitation). 

33. As to claim 36, Niemi teaches the information placed in the event log is first logged by 
the event logging mechanism (see rejection of claim 21 above regarding this limitation) 

34. As to claim 37, see rejection of claim 27 above. 

35. As to claim 38, see rejection of claim 29 above. 

36. Claims 15-16 are rejected under 35 U.S.C. 103(a) as being unpatentable over Niemi 
et al (U.S. 6,470,388) in view of Nock (U.S. 6,144,967). 

37. As to claim 15, Nock teaches turning on/off and configuring the event logging 
mechanism via a user interface (framework user initiates log analysis procedure via user 
interface, col. 15, lines 54-67). Therefore, it would have been obvious to turn on/off and 
configure the event logging mechanism via a user interface in Niemi. Browser is a well-known 
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type of user interface. Therefore, it would have been obvious to use a browser to implement the 
user interface of Nock. Note discussion of claim 1 1 for a motivation to combine. 

38. As to claim 16, Niemi teaches the event logging mechanism generates a plurality of event 
objects (plurality of records 514 in log file 506, fig. 5) and is configured to analyze the event 
objects (access and review contents of log file) and present to the results via the user interface 
(fig. 6). See col. 13, lines 2-15. Note discussion of claim 15 for using a browser to implement the 
user interface. 

39. Claims 17-18, 20, 22 and 25 are rejected under 35 U.S.C. 103(a) as being 
unpatentable over Niemi et al (U.S. 6,470,388) in view of Nock (U.S. 6,144,967) further in 
view of Ben-Natan et al (U.S. 5,740,354). 

40. As to claims 17, 18, Niemi as modified by Nock teaches (Nock) analyzing event objects 
based upon hierarchical grouping (perform_analysis() at log section or log levels, fig.s 17, 19 
and denoting text) and aggregating event objects deemed identical based upon hierarchical 
grouping (multiple (0. . .n) log section objects, fig. 14 and denoting text). 

41 . Niemi as modified by Nock does not teach contextual grouping of events. Ben-Natan 
teaches processing logged event data, including analyzing event data based on contextual 
grouping (related errors). See col. 14, lines 2-10. Therefore, it would have been obvious to 
analyze event objects/data based on contextual grouping in Niemi as modified. 
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42. One of ordinary skill in the art would have been motivated to combine the teachings of 
Niemi as modified and Ben-Natan because this would have provided users of Niemi better 
understanding of events/errors via association. (Ben-Natan, col. 3, line 37 - col. 4, line 14). 

43. As to claims 20, 22, 25, note the discussion of claim 17. 

44. Claims 4 and 33 are rejected under 35 U.S.C. 103(a) as being unpatentable over 
Niemi et al (U.S. 6,470,388) in view of Ladwig (U.S. 2002/0138663 Al) further in view of 
Sato (U.S. 5,819,094). 

45. As to claim 4, Sato teaches event logging and analysis, including analyzing event objects 
after event logging is turned off in that a user analyzes the log data contained within the history 
diagram, after program execution, and thus recording of the log data / history diagram, are 
completed (Col. 2, lines 43-56; col. 9, lines 18-57). Therefore, it would have been obvious to 
analyze event objects after event logging is turned off in Niemi as modified. One of ordinary 
skill in the art would have been motivated to combine the teachings of Niemi as modified and 
Sato because this would have enhanced log analysis by using visual manipulation of the log data. 
(Sato, col. 3, lines 6-13). 



46. 



As to claim 33, see rejection of claim 4 above. 
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47. Claims 5-9 are rejected under 35 U.S.C. 103(a) as being unpatentable over Niemi et 
al (U.S. 6,470,388) in view of Ladwig (U.S. 2002/0138663 Al) and Sato (U.S. 5,819,094) 
further in view of Nock (U.S. 6,144,967). 

48. As to claim 5, see rejection of claim 17 above. 

49. As to claim 6, see rejection of claim 18 above. 

i 

50. As to claim 7, Nock teaches traversing through the hierarchy of subgroups until the 
subgroup of finest granularity is traversed, subdividing the events into further subgroups, 
computing statistics for each subgroup while traversing, and displaying the statistics (col. 14, line 
49 - col. 15, line 2 and col. 16, line 30 - col. 17, line 14). 

51. As to claims 8-9, see rejections of claim 17, 18 and 7 above. 

Response to Arguments 

52. Applicant's arguments filed 8/1/2005 have been fully considered but they are not 
persuasive. 

In the remarks, Applicant argued in substance that (1) Niemi does not teach nor suggest 
creating an event object for an event to be logged that has not yet been logged within an 
application because in Niemi, the application provides logging at the local node regardless of 
whether logging is on or off, thus the central logger can only create data from the event logs of 
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the local loggers, (2) Niemi does not teach logging within the event object the start time and end 
time of the event, and (3) it is incorrect to assert that Niemi teaches creating event log data 
without any reference to event logs of the application. 

Examiner respectfully traverses Applicant arguments: 

- As to the point (1), Niemi does not teach providing logging at each local node as 
asserted by the applicant. Niemi teaches at each local node, a logging service layer which 
includes a communication resource, a call-back generator, and at least one state machine (col. 6, 
lines 13-19), the logging service layer communicates with the central logging facility and issues 
request to log an event (col. 10, lines 19-26 and col. 1 1, lines 57-65). Thus, there is not logging 
occur at each local node, thus, the argument is not persuasive. 

- As to the point (2), rejection has been changed to cite Ladwig to teach the limitation 
regarding start time and end time relating to an event (see rejection of claim 21 for more 
information). 

- As to the point (3), refer to discussion of point (1) above. 

Conclusion 

Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Diem K. Cao whose telephone number is (571) 272-3760. The 
examiner can normally be reached on Monday - Friday, 5:30AM - 2:00PM. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, William Thomson can be reached on (571) 272-3718. The fax phone number for the 
organization where this application or proceeding is assigned is 571-273-8300. 
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Information regarding the status of an application may be obtained from the Patent 
Application Information Retrieval (PAIR) system. Status information for published applications 
may be obtained from either Private PAIR or Public PAIR. Status information for unpublished 
applications is available through Private PAIR only. For more information about the PAIR 
system, see http://pair-direct.uspto.gov. Should you have questions on access to the Private PAIR 
system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). 

Any response to this action should be mailed to: 

Commissioner for Patents 
PO Box 1450 

Alexandria, VA 22313-1450 

Any inquiry of a general nature or relating to the status of this application should be 
directed to the TC 2100 Group receptionist at 571-272-2100. 



Diem Cao 




